Click a button: the page fetch()es the file (same-origin), base64-encodes the bytes into a data:<mime>;base64,… URL, and clicks a hidden <a download>.
fetch()
data:<mime>;base64,…
<a download>